{"id":"CVE-2026-89114","kind":"vulnerability","aliases":["CVE-2026-89114"],"related":[],"title":"SAP NetWeaver AS Java: unauthenticated web service requests leak sensitive business data","description":"SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability.","summary":"SAP NetWeaver AS Java's EDM application skips the authentication check on certain web service requests. An unauthenticated attacker can send a crafted request and read sensitive business information.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver AS Java EDM Application (CE-RA-EDM)","fixed":[],"affected":"7.50","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","netweaver","sap","self-hosted","unauthenticated","vendor"],"not_affected_if":["edm-not-deployed"],"how_to_check":"Check whether your SAP NetWeaver AS Java system has the EDM application component CE-RA-EDM 7.50 deployed (for example in SAP NetWeaver Administrator's software component list). Then see whether SAP Security Note 3810485 is applied. The note needs an SAP for Me login. Also check if the EDM web services are reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-11-10T01:17:21+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","triaged_at":"2026-11-10T01:28:24+00:00","updated_at":"2026-11-10T01:32:47+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T01:28:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver AS Java: unauthenticated web service requests leak sensitive business data","impact":"low","summary":"SAP NetWeaver AS Java's EDM application skips the authentication check on certain web service requests. An unauthenticated attacker can send a crafted request and read sensitive business information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","java","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads sensitive business information","analyst_note":"Find SAP's security note and the affected NetWeaver AS Java versions and patch level at https://nvd.nist.gov/vuln/detail/CVE-2026-89114 and SAP's Security Patch Day notes.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["edm-not-deployed"],"who_is_affected":"Organizations running SAP NetWeaver Application Server Java with the EDM application exposed to the network. The sources do not say which versions or which web service endpoints are affected, or whether the EDM application is enabled by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4542,"output_tokens":463,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's security note and the affected NetWeaver AS Java versions and patch level at https://nvd.nist.gov/vuln/detail/CVE-2026-89114 and SAP's Security Patch Day notes.","search":"'-2026':14A,17A '-89114':15A,18A 'applic':43B,71C 'application':24A 'as':21A 'attack':55B,85C 'authent':46B,76C 'avail':112C 'busi':11A,64B,95C 'ce':26A 'ce-ra-edm':25A 'certain':49B,79C 'check':47B,77C 'confidenti':104C 'could':86C 'craft':59B,90C 'cve':13A,16A 'data':12A 'edm':23A,28A,42B,70C 'high':101C 'host':34B 'impact':102C,108C 'inform':65B,96C 'integr':110C 'java':4A,22A,29B,40B,69C 'leak':9A 'netweav':2A,30B,38B,67C 'netweaver':20A 'perform':74C 'ra':27A 'read':62B 'request':8A,52B,60B,82C,91C 'result':98C 'retriev':93C 'sap':1A,19A,31B,37B,66C 'self':33B 'self-host':32B 'send':57B,87C 'sensit':10A,63B,94C 'servic':7A,51B,81C 'skip':44B 'special':89C 'unauthent':5A,35B,54B,84C 'vendor':36B 'web':6A,50B,80C","nicknames":[],"mitigations":[],"who_affected":"SAP NetWeaver AS Java systems running the EDM application (CE-RA-EDM 7.50). An unauthenticated attacker with network access can send crafted web service requests and read sensitive business data. Systems where the EDM web services are not exposed to untrusted networks have a lower risk. Teams without NetWeaver AS Java or without this component can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverasjavaedmapplicationceraedm","sapnetweaverasjavaedmapplicationceraedm"],"ptokens":["application","as","ce","edm","java","netweaver","ra","sap"],"labels":["high","java","netweaver","sap","selfhosted","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-89114':15A,18A 'application':24A 'as':21A 'busi':11A 'ce':26A 'ce-ra-edm':25A 'cve':13A,16A 'data':12A 'edm':23A,28A 'java':4A,22A 'leak':9A 'netweav':2A 'netweaver':20A 'ra':27A 'request':8A 'sap':1A,19A 'sensit':10A 'servic':7A 'unauthent':5A 'web':6A","search_b":"'applic':43B 'attack':55B 'authent':46B 'busi':64B 'certain':49B 'check':47B 'craft':59B 'edm':42B 'host':34B 'inform':65B 'java':29B,40B 'netweav':30B,38B 'read':62B 'request':52B,60B 'sap':31B,37B 'self':33B 'self-host':32B 'send':57B 'sensit':63B 'servic':51B 'skip':44B 'unauthent':35B,54B 'vendor':36B 'web':50B","search_c":"'applic':71C 'attack':85C 'authent':76C 'avail':112C 'busi':95C 'certain':79C 'check':77C 'confidenti':104C 'could':86C 'craft':90C 'edm':70C 'high':101C 'impact':102C,108C 'inform':96C 'integr':110C 'java':69C 'netweav':67C 'perform':74C 'request':82C,91C 'result':98C 'retriev':93C 'sap':66C 'send':87C 'sensit':94C 'servic':81C 'special':89C 'unauthent':84C 'web':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89114","severity":null,"published_at":"2026-11-10T01:17:21+00:00","modified_at":"2026-11-10T01:17:21+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","fetched_at":"2026-11-10T01:26:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89114:2379","url":"https://radar.offseq.com/threat/cve-2026-89114-cwe-862-missing-authorization-in-sapse-sap-netweaver-as-java-edm-application-0f344777abaecead","severity":null,"published_at":"2026-11-10T01:32:47+00:00","modified_at":"2026-11-10T01:32:47+00:00","first_seen_at":"2026-11-10T01:32:47+00:00","fetched_at":"2026-11-10T01:32:47+00:00","note":"SAP note 3810485 (me.sap.com, login required) not readable; SAP's Nov 2026 patch day page not indexed yet. Affected component CE-RA-EDM 7.50, CVSS 7.5 (AV:N/PR:N, C:H), CWE-862, from the CNA record as mirrored by OffSeq. No exploitation or PoC found. Nothing verified. Revisit when SAP's November patch day page is up.","cites":["https://radar.offseq.com/threat/cve-2026-89114-cwe-862-missing-authorization-in-sapse-sap-netweaver-as-java-edm-application-0f344777abaecead"]}],"documents":[{"id":112450,"url":"https://radar.offseq.com/threat/cve-2026-89114-cwe-862-missing-authorization-in-sapse-sap-netweaver-as-java-edm-application-0f344777abaecead","title":"OffSeq: CVE-2026-89114 (mirrors CNA record, cites SAP note 3810485)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}